CISA Domain 2B-1 Practice Test 001

This practice test covers Domain 2 (Governance & Management of IT) Subdomain B-1 (Resource Management) from the CISA exam content outline.

These questions are inspired by the ISACA CISA exam and are designed to help you test your knowledge of information systems auditing, governance, risk management, IT operations, business resilience, and information asset protection.

These are not official exam questions or brain dumps. They are original scenario-based questions created to reflect the audit judgment, control evaluation, and risk-based decision-making skills tested in the CISA exam.

Note: CISA and Certified Information Systems Auditor are registered trademarks of ISACA. This content is not affiliated with or endorsed by ISACA.

To choose CISA practice tests based on specific domains and subdomains, click that link.

CISA 2B-1 IT Resource Management Practice Test 001

10 questions • Single best answer

Question 1

An IS auditor is reviewing IT resource management at a regional bank. IT personnel are assigned to initiatives reactively based on who is available, and there is no capacity plan linking staffing to the approved project portfolio. Which of the following should concern the auditor MOST?

A. IT staff may accrue unplanned overtime that increases operating costs. B. Individual project managers may lack visibility into team members' vacation schedules. C. IT resources may not be allocated to the initiatives of highest strategic value to the organization. D. The IT department may be unable to justify future hiring requests to the finance function during annual budget planning cycles.

Question 2

During an audit of a government agency's IT function, the auditor wants to determine whether IT human and infrastructure resources are aligned with the agency's multi-year strategic objectives. The agency recently launched a large digital services program. Which of the following would provide the BEST evidence?

A. An IT resource allocation plan mapped to the agency's approved strategic initiatives and portfolio. B. Organizational charts showing current IT reporting lines and headcount by unit. C. Interviews with IT managers describing how they prioritize incoming work requests. D. A summary of IT training hours completed by staff during the prior fiscal year.

Question 3

An IS auditor examining a healthcare provider's IT resource management notes that several critical clinical systems depend on a single administrator with highly specialized skills, and no skills inventory or succession plan currently exists for that key role. What should the IS auditor do FIRST?

A. Recommend immediate cross-training of additional staff so the critical clinical systems no longer depend on one specialized administrator. B. Assess the extent to which critical services depend on the individual and the associated continuity risk. C. Recommend that the organization hire a second administrator with equivalent expertise. D. Report the single point of dependency as a high-risk finding to the audit committee.

Question 4

An audit of an energy utility's IT operations finds that specialized servers purchased for a cancelled initiative now sit idle, while other teams separately procure additional cloud capacity to meet their processing demand. Which recommendation is MOST appropriate to improve IT resource utilization across the organization?

A. Sell the idle servers to recover a portion of the original capital investment. B. Require all teams to standardize on centrally managed cloud capacity instead of purchasing their own on-premises servers in future. C. Assign the idle servers to the team currently leasing the most cloud capacity. D. Establish a centralized process to inventory, reallocate, and optimize IT assets before new procurement.

Question 5

An IS auditor reviews IT resource management at an insurance company and finds that no single function owns the allocation of shared IT resources; instead, each business unit negotiates directly with individual IT teams for the capacity it needs. Which of the following is the auditor's GREATEST concern?

A. Shared resources may be allocated based on unit influence rather than enterprise priority. B. Business units may develop inconsistent expectations about IT delivery timelines and the quality of the services they receive. C. IT teams may spend excessive time in negotiation meetings with business units. D. The organization may find it difficult to benchmark IT costs against industry peers.

Question 6

An IS auditor wants to determine whether an online retailer's IT capacity and resource planning will be effective ahead of a demanding peak sales season. The retailer experienced capacity-related outages during the previous holiday period. Which audit procedure would provide the MOST reliable assurance that resource planning is working as intended?

A. Review the retailer's documented IT capacity planning policy for completeness and alignment with recognized industry practices. B. Confirm that additional temporary IT staff were budgeted for the peak period. C. Compare historical resource forecasts with actual demand and assess variance and corrective actions. D. Interview the IT operations manager about confidence in meeting peak demand.

Question 7

A telecommunications company outsources part of its IT development to reduce its growing reliance on scarce internal technical skills. The IS auditor is evaluating whether this sourcing decision supports the organization's IT resource management objectives. Which factor is MOST important for the auditor to assess?

A. Whether the outsourcing vendor offers the lowest hourly rate among available providers. B. Whether the sourcing strategy aligns with the organization's IT strategy and long-term skill needs. C. Whether the vendor's developers are located in the same time zone as internal staff. D. Whether internal staff morale improved after transferring the development workload.

Question 8

During a review of a public university's IT resource management, the auditor finds that IT budget and headcount are allocated each year using the prior year's figures, without reference to current project demand, service levels, or the institution's strategic plans. Which finding is MOST significant?

A. The annual budgeting process does not account for inflation in IT vendor pricing. B. Some IT roles may be over- or under-funded relative to prevailing market salaries and comparable public-sector institutions. C. Historical budget data may contain errors that carry forward into future years. D. Resource allocation is disconnected from current business priorities and strategic objectives.

Question 9

Following an audit that recommended a formal IT resource capacity plan, an IS auditor conducts a follow-up review at a logistics firm. Management states that the plan is still 'in progress' but provides no documentation. What is the auditor's BEST course of action at this point?

A. Obtain and evaluate evidence of the plan's current status and interim resourcing controls. B. Accept management's statement and schedule the next follow-up for the following year. C. Close the finding because management has acknowledged and started remediation. D. Escalate the delay to the audit committee as an unresolved high-risk issue.

Question 10

An IS auditor evaluates a control requiring that all IT resource requests be approved through a centralized demand-management process aligned to the IT portfolio. Which of the following would provide the BEST assurance that this control is operating effectively throughout the entire period under review?

A. A documented procedure describing how resource requests should be reviewed and approved. B. A sample of resource requests showing consistent portfolio-based approval and prioritization. C. Confirmation from the PMO that a demand-management tool has been implemented. D. A management assertion that all resource requests follow the approval workflow.

Related Posts

Leave a Comment Cancel Reply